Jan 30 2018
- last edited on
Apr 07 2022
I am trying to write a log search query which gives me the information about all the services that are stopped are started in services.msc for past 3 hours. I have tried to use ConfigurationChange after going through the documentation, but it seems to be deprecated. The logs are not a part of Event or Perf either. Can anyone guide me through this.
Jan 31 2018 04:20 PM
I don't have any data in my subscriptions around services starting and stopping, but looking for event 7036 (The %1 service entered the %2 state) in the events table might be one approach. Not sure if it gets routed to the Event or SecurityEvent table, so can do a
union Event, SecurityEvent | where EventId == 7036 | ...
Jan 31 2018 07:19 PM - edited Jan 31 2018 07:28 PM
Thanks Evgeny. It is getting logged in Event Table with
ConfigurationChange | where ConfigChangeType == "WindowsServices" | where SvcDisplayName == "Xbox Live Auth Manager" | where SvcState == "Stopped"
Jan 31 2018 10:53 PMSolution
This article might help you as well: